Archive
16 January 2020
Vulnerabilities first published on this day (UTC), newest first.
5 results · Clear filters · Feed
-
High 8.0
RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux Application
In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where th…
-
Unscored —CVE-2019-15742 Public exploit
A local privilege-escalation vulnerability exists in the Poly Plantronics Hub before 3.14 for Windows client applicatio…
-
Critical 9.1
The WordPress plugin, WP Database Reset through 3.1, contains a flaw that allowed any unauthenticated user to reset any…
-
Medium 6.1CVE-2019-17573 Public exploit
Reflected Cross-Site Scripting in Apache CXF
By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack, which allows a malicious actor to inject javascript into the web p…
-
Unscored —CVE-2020-7108 Public exploit
The LearnDash LMS plugin before 3.1.2 for WordPress allows XSS via the ld-profile search field.